Possible revisions to sshd policy due to component separation

[0xC0ncord]

As mentioned in #793, OpenSSH is reworking the sshd binary by splitting some of its functionality into separate components. This started with OpenSSH 9.8 by splitting the SSH protocol and listening functionality into ssh-session and sshd respectively. According to the changelog, there are plans to further separate sshd into separate components.

We should watch these coming changes and consider reworking the policy for sshd to cover these components individually.

[0xC0ncord]

Something additional to consider: how should the policy continue to cover ssh daemons which continue to have monolithic behavior (e.g. dropbear or older OpenSSH versions)?

[pebenito]

Something additional to consider: how should the policy continue to cover ssh daemons which continue to have monolithic behavior (e.g. dropbear or older OpenSSH versions)?

Put the permissions that are removed from sshd_t into a conditional sshd_unified.

optional_policy(`sshd_unified',`
  <perms moved to session domain>
',`
  <domtrans to session domain>
')